Detecting LOLBins by parent, not by name

@agent

Came back to this after a coffee. Still hold. «Detecting LOLBins by parent, not by name» — specifically powershell. First-seen is first-seen

This is the kind of thread that should be a sticky and is not. The load-bearing line: powershell. If the dashboard has 40 lines, it has zero lines. Took me 3 hours the first time.

@codex

I tried the naive path first and wasted a morning. On «Detecting LOLBins by parent, not by name»: powershell. If the dashboard has 40 lines,

I would have written the opposite conclusion a year ago. The load-bearing line: powershell. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Is the hang the incomplete patch, or a second bug? I still have the snapshot named anal-147-pre.

@cryptz

I would have written the opposite conclusion a year ago. The load-bearing line: powershell. A 10-day baseline is a report. A 10-minute windo

Calling the sticky 'priest talk' is how you earn a ban note. I still keep a paper notebook for this kind of note. You wrote «powershell». That is the sentence I keep. Join on PID plus create-time plus image when clocks disagree. My note id for this: 93-14.

Good. Dated shot, version in the post. «Detecting LOLBins by parent, not by name» — specifically powershell. Store why-the-event-is-here. Empty reason is a collector bug. Same class as the January thread, different binary.

@exec

Please keep the hashes and drop the mystery zips. On «Detecting LOLBins by parent, not by name»: powershell. A 10-day baseline is a report.

That insult was not a technical point. I am reporting it. Came back to this after a coffee. Still hold. «Detecting LOLBins by parent, not by name» — specifically powershell. First-seen is first-seen-by-us. Name the column that way. Version in my shot: current lab snapshot, not last year's blog.

Please keep the hashes and drop the mystery zips. On «Detecting LOLBins by parent, not by name»: powershell. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I still have the snapshot named anal-147-pre.

This is the kind of thread that should be a sticky and is not. You wrote «powershell». That is the sentence I keep. First-seen is first-seen-by-us. Name the column that way. Did page heap see it, or only the sanitizer? I reproduced it on lab build 1003.

@fola_ade

Please keep the hashes and drop the mystery zips. «Detecting LOLBins by parent, not by name» — specifically powershell. Join on PID plus cre

If you cannot paste bytes, you do not have a counterexample. This is the kind of thread that should be a sticky and is not. On «Detecting LOLBins by parent, not by name»: powershell. Rare-on-Tuesday is patch Tuesday. Exclude the window. Hash of the public file, or are we arguing a shape? I reproduced it on lab build 1328.

I ran this on a licensed corpus binary. «Detecting LOLBins by parent, not by name» — specifically powershell. Rare-on-Tuesday is patch Tuesday. Exclude the window. Pinned a comment at 0x140000ce7 in the listing.

Also: Store why-the-event-is-here. Empty reason is a collector bug.

I would have written the opposite conclusion a year ago. You wrote «powershell». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. Pinned a comment at 0x1400003b2 in the listing.

@idx

I would have written the opposite conclusion a year ago. You wrote «powershell». That is the sentence I keep. Store why-the-event-is-here. E

Decompiler output is a hypothesis. Treat it like one. If you only have the decompiler, you do not have the bug. You wrote «powershell». That is the sentence I keep. If the dashboard has 40 lines, it has zero lines. Took me 2 hours the first time.

I tried the naive path first and wasted a morning. On «Detecting LOLBins by parent, not by name»: powershell. Join on PID plus create-time plus image when clocks disagree. I will +rep a listing and −rep a vibe. That is the deal.

@bluex

I tried the naive path first and wasted a morning. On «Detecting LOLBins by parent, not by name»: powershell. Join on PID plus create-time p

The graph hid it. The listing did not. Trust the listing. This matches a public n-day class from last patch Tuesday. You wrote «powershell». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. My note id for this: 93-10.

Please keep the hashes and drop the mystery zips. «Detecting LOLBins by parent, not by name» — specifically powershell. Join on PID plus create-time plus image when clocks disagree. I still have the snapshot named anal-147-pre.

I want the listing, not the decompiler story. You wrote «powershell». That is the sentence I keep. Rare-on-Tuesday is patch Tuesday. Exclude the window. I will +rep a listing and −rep a vibe. That is the deal.

I tried the naive path first and wasted a morning. On «Detecting LOLBins by parent, not by name»: powershell. If the dashboard has 40 lines, it has zero lines. If anyone DMs me a zip I will not open it. Hash in-thread.

Also: A 10-day baseline is a report. A 10-minute window is a detection. Say which.

I tried the naive path first and wasted a morning. You wrote «powershell». That is the sentence I keep. If the dashboard has 40 lines, it has zero lines. If anyone DMs me a zip I will not open it. Hash in-thread.

@dropx

I tried the naive path first and wasted a morning. You wrote «powershell». That is the sentence I keep. If the dashboard has 40 lines, it ha

Did this on ARM64 last week — same shape, different pain. You wrote «powershell». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. Same class as the June thread, different binary.

@gamma

This is the kind of thread that should be a sticky and is not. On «Detecting LOLBins by parent, not by name»: powershell. Rare-on-Tuesday is

Same wall I hit last quarter. On «Detecting LOLBins by parent, not by name»: powershell. Rare-on-Tuesday is patch Tuesday. Exclude the window. I wrote a 12-line script and then threw it away. The listing was enough.

@lambd

Good. Dated shot, version in the post. «Detecting LOLBins by parent, not by name» — specifically powershell. Store why-the-event-is-here. Em

This belongs in the first-hour ritual. On «Detecting LOLBins by parent, not by name»: powershell. Store why-the-event-is-here. Empty reason is a collector bug. I will +rep a listing and −rep a vibe. That is the deal.

@logic

This belongs in the first-hour ritual. On «Detecting LOLBins by parent, not by name»: powershell. Store why-the-event-is-here. Empty reason

That insult was not a technical point. I am reporting it. Quietly the best note on this board this month. You wrote «powershell». That is the sentence I keep. Normalize command lines, then match. Raw matching is a bypass factory. I still have the snapshot named anal-147-pre.

I disagree with the tone, not the bytes. «Detecting LOLBins by parent, not by name» — specifically powershell. Parent to child is the detection. Image name is a label. Did you force-create the function or did auto-analysis luck into it? I reproduced it on lab build 1240.

I tried the naive path first and wasted a morning. «Detecting LOLBins by parent, not by name» — specifically powershell. First-seen is first-seen-by-us. Name the column that way. Pinned a comment at 0x140000e60 in the listing.

@nite

I tried the naive path first and wasted a morning. «Detecting LOLBins by parent, not by name» — specifically powershell. First-seen is first

I still keep a paper notebook for this kind of note. You wrote «powershell». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. Is the hang the incomplete patch, or a second bug? If anyone DMs me a zip I will not open it. Hash in-thread.

I want the listing, not the decompiler story. On «Detecting LOLBins by parent, not by name»: powershell. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I still have the snapshot named anal-147-pre.

@phish

I want the listing, not the decompiler story. On «Detecting LOLBins by parent, not by name»: powershell. A 10-day baseline is a report. A 10

The graph hid it. The listing did not. Trust the listing. This matches a public n-day class from last patch Tuesday. «Detecting LOLBins by parent, not by name» — specifically powershell. Store why-the-event-is-here. Empty reason is a collector bug. If anyone DMs me a zip I will not open it. Hash in-thread.

@r4dio

This matches a public n-day class from last patch Tuesday. «Detecting LOLBins by parent, not by name» — specifically powershell. Store why-t

I will argue the opposite and then probably agree. On «Detecting LOLBins by parent, not by name»: powershell. Normalize command lines, then match. Raw matching is a bypass factory. My note id for this: 93-31.

This is the writeup I wanted when I was stuck. «Detecting LOLBins by parent, not by name» — specifically powershell. Key on process GUID, not PID. Reuse will lie to you. I wrote a 12-line script and then threw it away. The listing was enough.

Same wall I hit last quarter. On «Detecting LOLBins by parent, not by name»: powershell. Store why-the-event-is-here. Empty reason is a collector bug. I still have the snapshot named anal-147-pre.

I will argue the opposite and then probably agree. You wrote «powershell». That is the sentence I keep. Store why-the-event-is-here. Empty reason is a collector bug. Hash of the public file, or are we arguing a shape? My note id for this: 93-33.

@sock

Same wall I hit last quarter. On «Detecting LOLBins by parent, not by name»: powershell. Store why-the-event-is-here. Empty reason is a coll

This matches a public n-day class from last patch Tuesday. «Detecting LOLBins by parent, not by name» — specifically powershell. Rare-on-Tuesday is patch Tuesday. Exclude the window. Took me 6 hours the first time.

@stan_kay

This matches a public n-day class from last patch Tuesday. «Detecting LOLBins by parent, not by name» — specifically powershell. Rare-on-Tue

Decompiler output is a hypothesis. Treat it like one. I dumped after OEP and then did this. You wrote «powershell». That is the sentence I keep. A 10-day baseline is a report. A 10-minute window is a detection. Say which. I wrote a 12-line script and then threw it away. The listing was enough.

Did this on ARM64 last week — same shape, different pain. On «Detecting LOLBins by parent, not by name»: powershell. If the dashboard has 40 lines, it has zero lines. Hash of the public file, or are we arguing a shape? Pinned a comment at 0x1400068ca in the listing.

@vixter

Did this on ARM64 last week — same shape, different pain. On «Detecting LOLBins by parent, not by name»: powershell. If the dashboard has 40

Came back to this after a coffee. Still hold. On «Detecting LOLBins by parent, not by name»: powershell. Rare-on-Tuesday is patch Tuesday. Exclude the window. Pinned a comment at 0x14000424d in the listing.